topic How to extract field using rex command in Knowledge Management

How to extract field using rex command

philgopaul — Wed, 13 Feb 2019 02:15:11 GMT

Hi,

I have this sample log and I want to extract the request ID value after the period. Each of those numbers are unique in my log file.

Timeout sending message for request ID.140445678

I've tried various ways but cannot come up with working rex command that would extract those values as a field.

... | rex field=_raw "request <(?w+)>"

Any assistance would be awesome, thanks so much.

renjith_nair — Wed, 13 Feb 2019 06:59:32 GMT

@philgopaul ,

Try

|rex field=_raw "request ID\.(?<request_id>\d+)"

vinod94 — Wed, 13 Feb 2019 08:23:54 GMT

You can try this,

| makeresults 
| eval data="Timeout sending message for request ID.140445678" 
| rename data as _raw 
| rex "request\sID\.(?P<request_id>.*)"

woodcock — Wed, 13 Feb 2019 16:53:54 GMT

Try this:

... | rex "(?<request>\d+)[\r\n\s]*$"